Commit c1deb065 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: merge route type into core 



very little code, so it really doesn't make sense to have extra
modules or even a kconfig knob for this.

Merge them and make functionality available unconditionally.
The merge makes inet family route support trivial, so add it
as well here.

Before:
   text	   data	    bss	    dec	    hex	filename
    835	    832	      0	   1667	    683 nft_chain_route_ipv4.ko
    870	    832	      0	   1702	    6a6	nft_chain_route_ipv6.ko
 111568	   2556	    529	 114653	  1bfdd	nf_tables.ko

After:
   text	   data	    bss	    dec	    hex	filename
 113133	   2556	    529	 116218	  1c5fa	nf_tables.ko

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d164385e

include/linux/netfilter_ipv6.h

+15 −0
Original line number Diff line number Diff line
@@ -87,6 +87,21 @@ static inline int nf_ip6_route(struct net *net, struct dst_entry **dst, 
}



int ip6_route_me_harder(struct net *net, struct sk_buff *skb);



static inline int nf_ip6_route_me_harder(struct net *net, struct sk_buff *skb)

{

#if IS_MODULE(CONFIG_IPV6)

	const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();



	if (!v6_ops)

		return -EHOSTUNREACH;



	return v6_ops->route_me_harder(net, skb);

#else

	return ip6_route_me_harder(net, skb);

#endif

}



__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,

			unsigned int dataoff, u_int8_t protocol);

include/net/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -1411,4 +1411,6 @@ struct nft_trans_flowtable { 
int __init nft_chain_filter_init(void);

void nft_chain_filter_fini(void);



void __init nft_chain_route_init(void);

void nft_chain_route_fini(void);

#endif /* _NET_NF_TABLES_H */

net/ipv4/netfilter/Kconfig

+0 −8
Original line number Diff line number Diff line
@@ -27,14 +27,6 @@ config NF_TABLES_IPV4 


if NF_TABLES_IPV4



config NFT_CHAIN_ROUTE_IPV4

	tristate "IPv4 nf_tables route chain support"

	help

	  This option enables the "route" chain for IPv4 in nf_tables. This

	  chain type is used to force packet re-routing after mangling header

	  fields such as the source, destination, type of service and

	  the packet mark.



config NFT_REJECT_IPV4

	select NF_REJECT_IPV4

	default NFT_REJECT

net/ipv4/netfilter/Makefile

+0 −1
Original line number Diff line number Diff line
@@ -24,7 +24,6 @@ nf_nat_snmp_basic-y := nf_nat_snmp_basic.asn1.o nf_nat_snmp_basic_main.o 
$(obj)/nf_nat_snmp_basic_main.o: $(obj)/nf_nat_snmp_basic.asn1.h

obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o



obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o

obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o

obj-$(CONFIG_NFT_FIB_IPV4) += nft_fib_ipv4.o

obj-$(CONFIG_NFT_DUP_IPV4) += nft_dup_ipv4.o

net/ipv4/netfilter/nft_chain_route_ipv4.c

deleted100644 → 0
+0 −89
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>

 * Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 */



#include <linux/module.h>

#include <linux/init.h>

#include <linux/list.h>

#include <linux/skbuff.h>

#include <linux/netlink.h>

#include <linux/netfilter.h>

#include <linux/netfilter_ipv4.h>

#include <linux/netfilter/nfnetlink.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables_ipv4.h>

#include <net/route.h>

#include <net/ip.h>



static unsigned int nf_route_table_hook(void *priv,

					struct sk_buff *skb,

					const struct nf_hook_state *state)

{

	unsigned int ret;

	struct nft_pktinfo pkt;

	u32 mark;

	__be32 saddr, daddr;

	u_int8_t tos;

	const struct iphdr *iph;

	int err;



	nft_set_pktinfo(&pkt, skb, state);

	nft_set_pktinfo_ipv4(&pkt, skb);



	mark = skb->mark;

	iph = ip_hdr(skb);

	saddr = iph->saddr;

	daddr = iph->daddr;

	tos = iph->tos;



	ret = nft_do_chain(&pkt, priv);

	if (ret != NF_DROP && ret != NF_STOLEN) {

		iph = ip_hdr(skb);



		if (iph->saddr != saddr ||

		    iph->daddr != daddr ||

		    skb->mark != mark ||

		    iph->tos != tos) {

			err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);

			if (err < 0)

				ret = NF_DROP_ERR(err);

		}

	}

	return ret;

}



static const struct nft_chain_type nft_chain_route_ipv4 = {

	.name		= "route",

	.type		= NFT_CHAIN_T_ROUTE,

	.family		= NFPROTO_IPV4,

	.owner		= THIS_MODULE,

	.hook_mask	= (1 << NF_INET_LOCAL_OUT),

	.hooks		= {

		[NF_INET_LOCAL_OUT]	= nf_route_table_hook,

	},

};



static int __init nft_chain_route_init(void)

{

	nft_register_chain_type(&nft_chain_route_ipv4);



	return 0;

}



static void __exit nft_chain_route_exit(void)

{

	nft_unregister_chain_type(&nft_chain_route_ipv4);

}



module_init(nft_chain_route_init);

module_exit(nft_chain_route_exit);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");

MODULE_ALIAS_NFT_CHAIN(AF_INET, "route");

CRA Git | Maintained and supported by SUSTech CRA and CCSE